Access Openwrt via Wireguard over CGNAT

Gorneman · January 6, 2021, 3:46pm

Hi folks, I need a little help from you, friends.
I'm trying to set up a VPN network using Wireguard to access my Home network and services (SMB) that is behind a CGNAT (openwrt router is connected through usb tethering).
I'm using a VPS as Wireguard "hop": testing it using a smartphone client and seems to work.
But I can't connect Openwrt to VPS (can't establish an handshake).
Here's my configuration. Thanks for the help

{
	"kernel": "4.14.209",
	"hostname": "OpenWrt",
	"system": "ARMv7 Processor rev 0 (v7l)",
	"model": "Netgear Nighthawk X4S R7800",
	"board_name": "netgear,r7800",
	"release": {
		"distribution": "OpenWrt",
		"version": "19.07.5",
		"revision": "r11257-5090152ae3",
		"target": "ipq806x/generic",
		"description": "OpenWrt 19.07.5 r11257-5090152ae3"
	}
}
package network

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdbb:8'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth1.1'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.2.1'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'
	list dns '127.0.0.1'
	option peerdns '0'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'
	list dns '0::1'
	option reqprefix 'auto'
	option reqaddress 'try'
	option peerdns '0'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '5 0t'

config interface 'MODEM'
	option ifname 'eth0.2'
	option proto 'static'
	option netmask '255.255.255.0'
	option ipaddr '192.168.1.100'
	option gateway '192.168.1.1'

config interface 'guest'
	option proto 'static'
	option ipaddr '192.168.4.1'
	option netmask '255.255.255.0'

config interface 'wg0'
	option proto 'wireguard'
	list addresses '10.200.200.1/24'
	option private_key '4H/='
	option listen_port '51820'
	option auto '0'

config wireguard_wg0
	option description 'A3'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	option public_key 'qC='
	list allowed_ips '10.200.200.2/32'

config wireguard_wg0
	option description 'LT0p'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	option public_key '='
	list allowed_ips '10.200.200.3/32'

config wireguard_wg0
	option public_key '='
	option description 'WinPeer'
	option route_allowed_ips '1'
	option persistent_keepalive '25'
	list allowed_ips '10.200.200.4/32'

config interface 'TetheringWAN'
	option ifname 'usb0'
	option proto 'dhcp'
	list dns '127.0.0.1'
	option peerdns '0'

config interface 'wg1'
	option proto 'wireguard'
	option private_key 'gK='
	list addresses '10.0.0.2/24'
	option auto '0'
	option listen_port '51820'

config wireguard_wg1 'wgserver'
	option public_key 'AH='
	option endpoint_host '87.106.xxx.xxx'
	option endpoint_port '51820'
	option route_allowed_ips '1'
	list allowed_ips '10.0.0.0/24'
	option description 'IonosVPS'
	option persistent_keepalive '21'

package dhcp

config dnsmasq
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option localservice '1'
	option noresolv '1'
	list server '127.0.0.1#5453'
	list server '0::1#5453'
	list server '10.0.0.1'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv6 'server'
	option ra 'server'
	option ra_management '1'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'guest'
	option start '100'
	option leasetime '12h'
	option limit '150'
	option interface 'guest'

package firewall

config defaults
	option input 'ACCEPT'
	option output 'ACCEPT'
	option synflood_protect '1'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	option network 'lan wg0 wg1'

config zone
	option name 'wan'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'
	option network 'wan wan6 MODEM TetheringWAN'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option src_ip 'fc00::/6'
	option dest_ip 'fc00::/6'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config include
	option path '/etc/firewall.user'

config zone
	option network 'guest'
	option forward 'REJECT'
	option name 'guest'
	option output 'ACCEPT'
	option input 'REJECT'

config forwarding
	option dest 'wan'
	option src 'guest'

config rule
	option dest_port '53'
	option src 'guest'
	option name 'Guest DNS'
	option target 'ACCEPT'

config rule
	option dest_port '67'
	option src 'guest'
	option name 'Guest DHCP'
	option target 'ACCEPT'
	list proto 'udp'

config rule
	option src '*'
	option name 'Allow-Wireguard-Inbound'
	option target 'ACCEPT'
	list proto 'udp'
	option dest_port '51820'

config redirect
	option dest_port '514xx'
	option src 'wan'
	option name 'Transmission'
	option src_dport '51413'
	option target 'DNAT'
	option dest_ip '192.168.2.1xx'
	option dest 'lan'

config include 'bcp38'
	option type 'script'
	option path '/usr/lib/bcp38/run.sh'
	option family 'IPv4'
	option reload '1'

# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.

# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
6: usb0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
    inet 192..3/24 brd 192.168..255 scope global usb0
       valid_lft forever preferred_lft forever
8: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.2.1/24 brd 192.168.2.255 scope global br-lan
       valid_lft forever preferred_lft forever
10: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0.2
       valid_lft forever preferred_lft forever
13: wlan1-1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    inet 192.168..1/24 brd 192.168..255 scope global wlan1-1
       valid_lft forever preferred_lft forever
default via 192.168.42.129 dev usb0 proto static src 192.168.42.3 
87.106.194.214 via 192.168.1.1 dev eth0.2 proto static 
192.168.1.0/24 dev eth0.2 proto kernel scope link src 192.168.1.100 
192.168.2.0/24 dev br-lan proto kernel scope link src 192.168.2.1 
192.168.4.0/24 dev wlan1-1 proto kernel scope link src 192.168.4.1 
192.168.42.0/24 dev usb0 proto kernel scope link src 192.168.42.3 
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1 
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1 
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1 
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1 
broadcast 192.168.1.0 dev eth0.2 table local proto kernel scope link src 192.168.1.100 
local 192.168.1.100 dev eth0.2 table local proto kernel scope host src 192.168.1.100 
broadcast 192.168.1.255 dev eth0.2 table local proto kernel scope link src 192.168.1.100 
broadcast 192.168.2.0 dev br-lan table local proto kernel scope link src 192.168.2.1 
local 192.168.2.1 dev br-lan table local proto kernel scope host src 192.168.2.1 
broadcast 192.168.2.255 dev br-lan table local proto kernel scope link src 192.168.2.1 
broadcast 192.168.4.0 dev wlan1-1 table local proto kernel scope link src 192.168.4.1 
local 192.168.4.1 dev wlan1-1 table local proto kernel scope host src 192.168.4.1 
broadcast 192.168.4.255 dev wlan1-1 table local proto kernel scope link src 192.168.4.1 
broadcast 192.168.42.0 dev usb0 table local proto kernel scope link src 192.168.42.3 
local 192.168.42.3 dev usb0 table local proto kernel scope host src 192.168.42.3 
broadcast 192.168.42.255 dev usb0 table local proto kernel scope link src 192.168.42.3 
0:	from all lookup local 
32766:	from all lookup main 
32767:	from all lookup default 
ls: /tmp/resolv.*/*: No such file or directory
lrwxrwxrwx    1 root     root            16 Dec  6 08:31 /etc/resolv.conf -> /tmp/resolv.conf
lrwxrwxrwx    1 root     root            21 Jan  6 15:29 /tmp/resolv.conf -> /tmp/resolv.conf.auto
-rw-r--r--    1 root     root            46 Jan  6 15:30 /tmp/resolv.conf.auto
==> /etc/resolv.conf <==
# Interface TetheringWAN
nameserver 127.0.0.1

==> /tmp/resolv.conf <==
# Interface TetheringWAN
nameserver 127.0.0.1

==> /tmp/resolv.conf.auto <==
# Interface TetheringWAN
nameserver 127.0.0.1
head: /tmp/resolv.*/*: No such file or directory

trendy · January 6, 2021, 4:29pm

Please remove the screenshots and run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*

Gorneman · January 30, 2021, 2:36pm

Using a raspberry as companion I have solved the problem. Thanks

openwrtforever · January 30, 2021, 3:41pm

You can also use IPv6 on your raspberry for direct access using wireguard.

system · February 9, 2021, 3:41pm

This topic was automatically closed 0 minutes after the last reply. New replies are no longer allowed.